Chapter 5 Advanced Encryption Standard

1. Chapter 5 Advanced Encryption Standard

2. Origins • clear a replacement for DES was needed • have theoretical attacks that can break it • have demonstrated exhaustive key search attacks • US NIST issued call for ciphers in 1997 • 15 candidates accepted in Jun 98 • 5 were short-listed in Aug-99 • Rijndael was selected as the AES in Oct-2000 • According to NIST, if someone build a machine that could break DES in 1 second, it would take 149 trillion years to crack a 128-bit AES key.

3. AES Requirements • private key symmetric block cipher • 128-bit data, 128/192/256-bit keys • stronger & faster than Triple-DES • active life of 20-30 years (+ archival use) • provide full specification & design details • both C & Java implementations • NIST have released all submissions & unclassified analyses

4. AES Evaluation Criteria • initial criteria: • security – effort to practically cryptanalysis • cost – computational • algorithm & implementation characteristics • final criteria • general security • software & hardware implementation ease • implementation attacks • flexibility (in en/decrypt, keying, other factors)

5. The AES Cipher - Rijndael • designed by Rijmen-Daemen in Belgium • has 128/192/256 bit keys, 128 bit data • an iterative rather than feistel cipher • treats data in 4 groups of 4 bytes • operates an entire block in every round • designed to be: • resistant against known attacks • speed and code compactness on many CPUs • design simplicity

7. Rijndael • processes data as 4 groups of 4 bytes (state) • has 9/11/13 rounds in which state undergoes: • byte substitution (1 S-box used on every byte) • shift rows (permute bytes between groups/columns) • mix columns (subs using matrix multiply of groups) • add round key (XOR state with key material) • initial XOR key material & incomplete last round • all operations can be combined into XOR and table lookups - hence very fast & efficient

8. Rijndael

10. AES Key Expansion • takes 128-bit (16-byte) key and expands into array of 44/52/60 32-bit words • start by copying key into first 4 words • then loop creating words that depend on values in previous & 4 positions back • in 3 of 4 cases just XOR these together • every 4th has S-box + rotate + XOR constant of previous before XOR together • designed to resist known attacks

11. AES Key Expansion KeyExpansion (byte key[16], word w[44]) {word temp for (i=0; i<4; i++) w[i]=(key[4*i], key[4*i+1], key[4*i+2], (key[4*i+3]); for (i=4; i<44; i++) {temp=w[i-1]; if (i mod 4 = 0) then temp=SubWord(RotWord(temp))Rcon[i/4]; w[i]= w[i-4]temp } }

13. AES Key Expansion RotWord: left rotate one byte, [b0, b1,b2,b3][b1,b2,b3,b0] SubWord: byte substitution Rcon[j]=(RC[j], 0, 0, 0) RC[1]=1; RC[j]=2*RC[j-1] over GF(28) m(x)=“11B” Ex: the round key for round 8 is EA D2 73 21 B5 8D BA D2 31 2B F5 60 7F 8D 29 2F

14. Add Round Key • XOR state with 128-bits of the round key • again processed by column (though effectively a series of byte operations) • inverse for decryption is identical since XOR is own inverse, just with correct round key • designed to be as simple as possible

15. Byte Substitution • a simple substitution of each byte • uses one table of 16x16 bytes containing a permutation of all 256 8-bit values • each byte of state is replaced by byte in row (left 4-bits) & column (right 4-bits) • eg. byte {95} is replaced by row 9 col 5 byte • which is the value {2A} • S-box is constructed using a defined transformation of the values in GF(28) • designed to be resistant to all known attacks

18. Shift Rows • a circular byte shift in each row • 1st row is unchanged • 2nd row does 1 byte circular shift to left • 3rd row does 2 byte circular shift to left • 4th row does 3 byte circular shift to left • decrypt does shift to right • since state is processed by columns, this step permutes bytes between the columns

20. Mix Columns • each column is processed separately • each byte is replaced by a value dependent on all 4 bytes in the column • effectively a matrix multiplication in GF(28) using prime poly m(x) =x8+x4+x3+x+1

21. AES Encryption Round

22. AES Decryption • AES decryption is not identical to encryption • with a different key schedule • swap byte substitution & shift rows • swap mix columns & add (tweaked) round key • The transformations replaced by their inverses • The inverse of AddRoundKey: itself • InverseShiftRows: right rotate • InverseSubBytes • InverseMixColumns

24. Inverse mix column transformation

25. Implementation Aspects • can efficiently implement on 8-bit CPU • byte substitution works on bytes using a table of 256 entries • shift rows is simple byte shifting • add round key works on byte XORs • mix columns requires matrix multiply in GF(28) which works on byte values, can be simplified to use a table lookup

26. Implementation Aspects • can efficiently implement on 32-bit CPU • redefine steps to use 32-bit words • can pre-compute 4 tables of 256-words • then each column in each round can be computed using 4 table lookups + 4 XORs • at a cost of 16Kb to store tables • designers believe this very efficient implementation was a key factor in its selection as the AES cipher